Runs Permissions¶
Actions on datastore Runs (Abort, Resume, Rerun, Delete), other than Global Export, are gated by the Editor team permission on the target datastore. Without the right combination of a user role and a team permission on the datastore, the action buttons either do not appear in the expanded Run row or return a permission error when invoked.
Two permission systems
Qualytics has two separate role systems, and datastore Runs other than Global Export require the right combination of both:
- User Roles (Member, Manager, Admin) control what a user can do across the entire workspace.
- Team Permissions (Reporter, Viewer, Drafter, Author, Editor) control what a user can do on specific datastores accessed through team membership.
Team permission matrix¶
For Runs other than Global Export, the following team-permission matrix applies to viewing Runs and acting on them. Whether the action is supported by a specific operation is a separate question (see Action support by operation type below).
| Action | Reporter | Viewer | Drafter | Author | Editor |
|---|---|---|---|---|---|
| View Runs and their results | |||||
| Abort a Run | |||||
| Resume a Run | |||||
| Rerun a Run | |||||
| Delete a Run you triggered (Admins can delete any Run) |
The Editor team permission is granted on a per-datastore basis through team memberships. For a full reference of team permissions and how they are assigned, see Team Permissions Overview.
Admin bypass
Users with the Admin user role bypass all team-permission checks and can act on any Run, regardless of team membership.
Global Export runs are gated by role
A Global Export run writes data that belongs to the whole organization (check templates or the Access Report) into an enrichment datastore, so the Editor team permission on that datastore does not decide who may act on it. Aborting, rerunning, or deleting one takes the same role as starting it: Manager or Admin for a check template export, Admin only for an Access Report export. Deleting a Global Export run also requires that you triggered it, unless you are an Admin. An abort that comes from aborting the Flow execution that started the export is allowed to whoever may abort that execution. See Export Check Templates and Configure a Global Export Action.
Action support by operation type¶
Permission alone is not enough. The action must also be supported by the operation type. See Available Actions for the full support matrix.
For per-operation permission details (configuring operation settings, scheduling recurring runs, and so on), see the operation's own Permissions page:
See also¶
-
How It Works
What a Run is for, what does not appear as a Run, and the contexts of the Activity tab.
-
Details
The Overview tab of the detail page, with the Run's key details, settings, summary metrics, logs, and timeline.
-
Results
The Results tab of the detail page, with the per-container breakdown of a Scan, Profile, or Promote, and where a Sync, Export, or Materialize wrote its results.
-
Anatomy
The components every Run exposes, from the status badge to the progress bar with its phase messages.
-
Quick Stats Icons
The icon cluster on the right of the Run row, broken down per operation type.
-
States
The five canonical states plus the Warning indicator, and what each one means.
-
Lifecycle
State diagram of how a Run moves between Queued, Running, Success, Failure, and Aborted, plus where to find the per-container progress and logs.
-
Available Actions
Abort, Resume, Rerun, and Delete: when each one is shown, what it does, and which operation types support it.